//! Signed requests and the proofs events carry (spec §8.5, §9.5).

//!

//! A principal signs `"spectra1 request " || method || 0x00 || BLAKE3(body)

//! || time (8 bytes) || nonce (16 bytes)` with its key, through `oxy-core`'s

//! challenge signing. The signature, with what it covered, is the proof

//! kept on every event the request causes, so a verifier can check later,

//! from the ledger alone, which key asked for it.

//!

//! The CLI, writing to the ledger itself, signs with `method = "cli"` and

//! `body` = the event's canonical payload, so its proof also binds the

//! event's content.

use crate::keys::KeyPair;

use oxy_core::cbor::{self, Value};

use oxy_core::identity::{Identity, Signature};

use rand::RngCore;

/// How far a request's time may be from the server's clock (spec §8.5).

pub const WINDOW_MS: u64 = 5 * 60 * 1000;

/// A signature with everything it covered except the body itself.

#[derive(Clone, Debug, PartialEq, Eq)]

pub struct Proof {

    pub sig: Signature,

    pub method: String,

    pub body_hash: [u8; 32],

    pub time_ms: u64,

    pub nonce: [u8; 16],

}

impl Proof {

    /// Sign `method` and `body` now with `pair`.

    pub fn sign(pair: &KeyPair, method: &str, body: &[u8]) -> Proof {

        let mut nonce = [0u8; 16];

        rand::rngs::OsRng.fill_bytes(&mut nonce);

        Proof::sign_at(pair, method, body, crate::ids::now_ms(), nonce)

    }

    pub fn sign_at(pair: &KeyPair, method: &str, body: &[u8], time_ms: u64, nonce: [u8; 16]) -> Proof {

        let body_hash = *blake3::hash(body).as_bytes();

        let sig = pair.sign(&message(method, &body_hash, time_ms, &nonce));

        Proof { sig, method: method.into(), body_hash, time_ms, nonce }

    }

    /// The signing key's KeyId.

    pub fn key(&self) -> [u8; 32] {

        self.sig.key.0

    }

    /// Check the signature against `identity` and, when given, the body.

    pub fn verify(&self, identity: &Identity, body: Option<&[u8]>) -> Result<(), String> {

        if let Some(b) = body {

            if *blake3::hash(b).as_bytes() != self.body_hash {

                return Err("the signature covers a different body".into());

            }

        }

        let msg = message(&self.method, &self.body_hash, self.time_ms, &self.nonce);

        oxy_core::identity::verify_challenge(identity, &self.sig, &msg).map_err(|e| format!("signature does not verify: {e}"))

    }

    pub fn encode(&self) -> Vec<u8> {

        cbor::encode(&Value::map([

            (0, self.sig.to_value()),

            (1, Value::Text(self.method.clone())),

            (2, Value::Bytes(self.body_hash.to_vec())),

            (3, Value::Uint(self.time_ms)),

            (4, Value::Bytes(self.nonce.to_vec())),

        ]))

    }

    pub fn decode(b: &[u8]) -> Result<Proof, String> {

        let v = cbor::decode(b).map_err(|e| format!("malformed proof: {e}"))?;

        let m = v.as_map().ok_or("malformed proof")?;

        let get = |k: u64| m.get(&k).ok_or_else(|| format!("proof lacks field {k}"));

        Ok(Proof {

            sig: Signature::from_value(get(0)?).map_err(|e| format!("malformed signature: {e}"))?,

            method: get(1)?.as_text().ok_or("proof method")?.to_string(),

            body_hash: get(2)?.as_bytes().and_then(|b| b.try_into().ok()).ok_or("proof body hash")?,

            time_ms: get(3)?.as_uint().ok_or("proof time")?,

            nonce: get(4)?.as_bytes().and_then(|b| b.try_into().ok()).ok_or("proof nonce")?,

        })

    }

}

/// `"spectra1 request " || method || 0 || body_hash || time || nonce`.

pub fn message(method: &str, body_hash: &[u8; 32], time_ms: u64, nonce: &[u8; 16]) -> Vec<u8> {

    let mut m = b"spectra1 request ".to_vec();

    m.extend_from_slice(method.as_bytes());

    m.push(0);

    m.extend_from_slice(body_hash);

    m.extend_from_slice(&time_ms.to_be_bytes());

    m.extend_from_slice(nonce);

    m

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn a_proof_round_trips_and_binds_key_method_body_and_time() {

        let a = KeyPair::generate("a", "");

        let b = KeyPair::generate("b", "");

        let p = Proof::sign(&a, "POST /mcp", b"{\"x\":1}");

        let q = Proof::decode(&p.encode()).unwrap();

        assert_eq!(p, q);

        q.verify(&a.identity, Some(b"{\"x\":1}")).unwrap();

        assert!(q.verify(&a.identity, Some(b"{\"x\":2}")).is_err(), "another body");

        assert!(q.verify(&b.identity, None).is_err(), "another key");

        let mut r = q.clone();

        r.method = "POST /api".into();

        assert!(r.verify(&a.identity, None).is_err(), "another method");

        let mut t = q.clone();

        t.time_ms += 1;

        assert!(t.verify(&a.identity, None).is_err(), "another time");

    }

}